CVE-2026-71217 Iperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

EUVD-2026-55990

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

CVE-2026-71217 Iperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

CVE-2026-71217

This CVE affects iperf3. The flaw arises from improper validation of control-channel JSON, where oversized numeric parameters (e.g., parallel, len) can trigger excessive stream/thread creation and large buffer allocations, leading to resource exhaustion and a Denial of Service on the affected ipe...

CVE-2026-71217

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

CVE-2026-71217

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

CVE-2026-71217

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins

Cybersecurity researchers have warned of a supply chain compromise impacting WordPress plugin vendor BdThemes, prompting the content management systems CMS platform's plugins team to temporarily disable their downloads. "Unlike traditional software supply chain attacks, zero source code files wer...

CVE-2025-31114: Improper Neutralization of Directives in Dynamically Evaluated Code

Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when processing metadata JSON. An attacker with access to the Fooocus web UI may be able to execute arbitrary code on the instance. As of...

PT-2026-70240

Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when processing metadata JSON. An attacker with access to the Fooocus web UI may be able to execute arbitrary code on the instance. As of...

PT-2026-70223

Name of the Vulnerable Software and Affected Versions @swc/html versions prior to 1.15.47-nightly-20260729.1 swc html minifier versions prior to 59.0.0 Description The minifyJson processing in crates/swc html minifier/src/lib.rs fails to implement the escape json for html script behavior when...

CVE-2026-29036: Use of Incorrectly-Resolved Name or Reference

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decodepointerinplace function within cJSONUtils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape...

PT-2026-70247

Name of the Vulnerable Software and Affected Versions Vim versions 9.2.0511 through 9.2.0843 Description The json decode item function in src/json.c can retain a stale pointer after json decode string calls channel fill to refill and free the current buffer. This occurs when an invalid JSON strin...

CVE-2026-72925: Improper Neutralization of Input During Web Page Generation

SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swchtmlminifier 59.0.0, the minifyJson processing in crates/swchtmlminifier/src/lib.rs parsed and serialized attacker-controlled JSON in application/json and application/ld+json script...

PT-2026-80184

GHSA-6wgq-wg3w-jgvx: svxreflector: use-after-free write via dangling JSON reference...

CVE-2026-48494: Authorization Bypass Through User-Controlled Key

TypeBot is a chatbot builder tool. In version 3.16.1, an authenticated user who has read access to any typebot can resume a WhatsApp preview webhook session that belongs to a different typebot by mixing an authorized typebotId and blockId and a foreign preview phone number tied to another preview...

CVE-2026-71217: Improper Input Validation

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

PT-2026-70098

Name of the Vulnerable Software and Affected Versions iperf3 affected versions not specified Description A remote unauthenticated attacker can exploit a flaw in the JSON read function. The function accepts a message length controlled by the peer and allocates memory without an upper bound, which...

CVE-2026-73071: Use After Free

Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, jsondecodeitem in src/json.c can retain a stale pointer after jsondecodestring invokes channelfill to refill and free the current buffer, causing the error path to read freed memory instead of reader-jsbuf +...

CVE-2026-47704: Authorization Bypass Through User-Controlled Key

TypeBot is a chatbot builder tool. Prior to version 3.17.0, an authenticated user who has read access to any typebot can resume a waiting webhook session that belongs to a different typebot by mixing an authorized typebotId and blockId and a foreign live resultId. The webhook resume handler...